1. Field of the Invention
The invention relates generally to techniques for securing a computer system. More specifically, the invention is a method and apparatus for securing a peripheral data interface, such as a USB port.
2. Description of the Related Art
Recently, personal media devices such as PDAs, smart phones, digital cameras, MP3 players and others have gained wide popularity in corporate and personal environments. This has been coupled with a massive increase in the available storage capacity of both integrated memory components and a class of devices known as transient storage devices (TSDs), such as USB flash drives.
TSDs are easily connected to the peripheral interface of a networked enterprise computer and therefore pose a significant risk to corporate security, in terms of the management and protection of corporate intellectual property, network vulnerability and enforcement of other corporate policies.
One method of protecting a peripheral interface, such as a USB port, is to use a commercially available, software-based port monitor. These products provide administrated device authorization based on USB device identification, such as device class or a unique ID. However, software-based port protection is vulnerable to tampering, requires administration and maintenance, consumes computer resources, and may affect the performance of computer applications or legitimate peripheral devices. One method of reducing the administrative overhead is to use third-part web-based monitoring services which provide policy enforcement and authentication services. However, these services do not solve the fundamental limitations of software-based port protection.
Another technique for providing device authentication is presently being standardized as IEEE P1667. P1667 is intended as a standard protocol for the authentication of TSDs in host environments using lower layer authentication methods. The core requirement of P1667 is to associate a TSD to a specific organization, person, device and location. P1667 enables authentication of TSD to hosts and vice versa. Authentication is initiated by a host operating system and device functionality is “pulled” from the host. The proposed technique does not need any specific drivers or security-related executables. However, any operating-system related technique still introduces overhead, requires maintenance and is susceptible to tampering.
In view of the shortfalls of these interface security techniques, there is a need in the art for an improved tamper-resistant techniques without any additional maintenance burden or performance overhead.